[jerf]

'Also, wonder how they're verifying "The bank maintained that no suspicious transactions had slipped through as a result."'

I have no inside information, but I will observe there's a well-traveled road where organizations end up loudly announcing they couldn't find any exploitation of a given bug, or that it was limited to scope X, only to later announce that, oh, whoops, they found some, or that the scope was larger than they thought.

Sometimes I find it easy to believe it's honest, like an ongoing security incident for a relatively transparent organization where the news is only hours old. Sometimes... I find it quite easy to believe it's not honest. I don't have enough info to decide in this particular case but it wouldn't shock my priors for it to be the latter here.